No credentials in the workspace
Agents act through the gateway. Secrets stay encrypted with KMS.
Security
Agents never hold your keys. Every action is checked, recorded and kept only as long as you need it.
Request accessSafe by default.
The platform, not the agent, holds the keys and decides what runs.
Code runs in a sandbox
Chat sandboxes run under gVisor, apart from the host.
Message text stays out of logs
Logs keep ids, not words. Analytics drop personal fields.
Access and approvals.
People decide what agents may do, and the platform checks it on every call.
-
Roles
Org owners and admins set policy. Project admins approve changes. Members approve actions.
-
Scoped connections
Each project reaches only the connections it is given.
-
Linked identities
A click in Slack counts only from a person with a linked account and the right role.
-
Personal accounts
When an agent acts as a person, it uses that person’s own connected account.
-
Approvals
Sensitive actions and every change to a project wait for a person to approve.
Encryption and isolation.
Secrets are encrypted at rest, and each run stays inside its own workspace.
-
Envelope encryption
Connection secrets, login tokens and webhook secrets are encrypted with KMS-managed keys.
-
Private storage
Transcripts and attachments live in a private bucket, encrypted with KMS.
-
Signed webhooks
Inbound events are checked against a per-hook or per-connection secret.
-
Workspace guards
File tools cannot reach outside the run’s workspace, even through a symlink.
-
Plugins without secrets
Plugins carry no credentials. Org hooks run only if an org admin turns them on.
A record of everything.
You can see what every agent did, why it was allowed and who approved it.
-
Every action
Each tool call is stored with the rule that allowed it and its result.
-
Every decision
Approvals record who decided, when and on what.
-
Every change
Records and project memory keep a history of each change and who made it.
-
Every plugin
Each plugin version records its author, its diff and who approved it.
-
One trace
A trace id links each reply to the event that caused it.
Data kept only as long as needed.
Each kind of data has one retention period. Orgs can lengthen some of them.
| Data | Kept for |
|---|---|
| Events | 30 days |
| Conversation text | 180 days, then the text is removed |
| Actions and rule steps | 365 days |
| Record and memory history | 365 days |
| Transcripts and attachments | 365 days |
| Analytics, without personal fields | 400 days |
| Logs and traces, ids only | 30 days and 14 days |
Erase a person
An org admin can erase a member or an outside user. Their messages, links and personal connections are removed or redacted in every store, and each step is recorded.
Offboard an org
The org owner can close the org. Hinzel pauses its work, closes its runs, cancels billing and deletes its data, in that order.